Michael O'Hanlon

Senior Fellow and Co-holder of Sydney Stein Chair
Foreign Policy Studies Program
October 26, 2005

Testimony before the Senate Subcommittee on Terrorism, Technology, and Homeland Security of the Committee of the Judiciary, for October 26, 2005

ASSESSING THE STATE OF HOMELAND SECURITY

Michael O'Hanlon, mohanlon@brookings.edu (10/21/05)

Chairman Kyl, Senator Feinstein, and other members of the subcommittee, it is an honor to appear before you today to discuss the enormously important question of our nation's security against possible future terrorist attacks. The recent Katrina experience reminds us of what is at stake, especially since a terrorist attack would clearly provide substantially less warning. President Bush's October 6, 2005 speech in Washington revealed how many times potential terrorist strikes had been in the works against the United States even since 9/11/2001. The July subway attacks in London remind us that the danger of such attacks has not ended, even within the western world. And globally, the strength of the jihadist terror movement (broadly defined) is on balance as great as ever. Clearly we cannot let down our guard. Yet we must also be judicious, cost-effective, and pragmatic in how we attempt to counter terrorism here at home, given the costs to our pocketbooks and way of life of any excessive efforts to protect the homeland.

I have been asked to explore the likely consequences of several potentially severe terrorist scenarios and to assess what steps may have been taken already to address the risks. I will do this with a review of steps taken--and not taken--since 2001, as well as a compendium of tables and quantitative estimates showing the possible human and economic costs of various types of successful attacks. But first, I will summarize several main conclusions.

? The United States has taken a number of impressive steps since 9/11/2001 to protect itself against terror. The greatest progress has been witnessed in air security, protection of key government property and prominent infrastructure and other symbolically significant sites in our country, some types of protection against biological attack, elimination of legal and bureaucratic barriers due to the Patriot Act and intelligence reform, and greater integration of our border security agencies as well as our terrorism watch lists.
? However, even within these relatively successful areas, much remains to be done. Private planes are not regulated as well as commercial ones. Large private skyscrapers are not all prudently protected against truck bombs or biological or chemical attacks. Capacity to produce and distribute antidotes to most types of biological attacks is woefully insufficient. Border security resources remain too limited, and intelligence integration cannot yet begin to truly "connect dots" about looming terrorist strikes through automated information analysis.
? And many types of protective measures remain to be even seriously initiated. For example, the chemical industry and the transportation systems that serve it are barely protected at all. Passenger trains and buses are still very vulnerable (perhaps, to some extent, inevitably so). Electricity infrastructure is badly protected and systemically fragile. Food supplies are largely undefended.
? Some types of possible homeland security measures are currently either impractical or unnecessary (or some combination thereof). These include 100% screening of cargo containers entering the country, protection of most malls and restaurants against suicide bombers and individuals with semiautomatic weapons, and creation of large additional hospital capacity for quarantining patients with contagious diseases. But many other measures are overdue, in that they would respond to major national vulnerabilities and do so with good effectiveness at reasonable cost.
? A number of plausible terrorist scenarios could be every bit as bad, if generally not as geographically extensive in effect, as Hurricane Katrina. We should use the reminder of that terrible natural catastrophe to focus ourselves not only on rebuilding the Gulf Coast and improving disaster response, but continuing to improve homeland security more generally with a sense of urgency.
? A specific scenario akin in some ways to the Katrina experience is worth noting. An attack against the Hoover or Glen Canyon dams on the Colorado River could be catastrophic in at least three ways--the rapid inundation of small nearby towns, with high fatality rates likely; the probable destruction of large swaths of major downriver cities, notably Las Vegas; and the extended economic disruption resulting from demolition of facilities so critical to the water and electricity supplies of the southwestern United States.

MAIN TESTIMONY

Since the attacks of September 11, 2001, a good deal has been done to improve the safety of Americans. Much of that increase in safety has come from offensive operations abroad--the military overthrow of the Taliban and associated attacks against al Qaeda, as well as the intelligence and covert operations conducted by the United States in conjunction with key allies such as Pakistan. These steps have lessened U.S. vulnerability to the kind of attacks the country so tragically suffered four years ago.

Homeland security efforts have improved too. Now aware of the harm terrorists can inflict, Americans are on alert, providing a first, crucial line of defense. Air travel is much safer, with screening of all passenger luggage, hardened cockpit doors on all large American commercial aircraft, thousands of air marshals, and armed pilots on some commercial and cargo flights.

Intelligence sharing has improved, especially information about specific individuals suspected of ties to terrorism, through increased integration of databases and greater collaboration between the FBI and the intelligence community. These initial efforts have now been reinforced by the passage of the 2004 Intelligence Reform and Terrorism Prevention Act of 2004. Such linkages of databases can enable offensive operations abroad; they can also assist greatly in the more defensive, but equally critical, domain of homeland security operations.

The share of FBI resources devoted to counterterrorism has doubled, and combined CIA/FBI personnel working on terrorist financing alone have increased from less than a dozen to more than 300 since September, 2001. International cooperation in sharing information on suspected terrorists has improved--extending beyond countries that have been helpful over many years such as France and Britain to include many other states such as Pakistan and Saudi Arabia that now take the threat more seriously.

Additional efforts have also been initiated. A number took place after the 2001 anthrax attacks, others were responses to information gained in prisoner interrogations and other intelligence efforts. Suspicious ships entering U.S. waters are now screened more frequently. The country's exposure to biological attacks has been lessened by stockpiling of hundreds of millions of doses of antibiotics and smallpox vaccine. Oversight rules have been tightened on labs working with biological materials (though actual implementation of those rules, including completion of background checks on lab employees, has lagged). Terrorism insurance is now backstopped by a new federal program. Certain types of major infrastructure, such as well-known bridges and tunnels, are protected by police and National Guard forces during terrorism alerts. Nuclear reactors have better protection than before. Federal agencies are required to have security programs for their information technology networks, and many private firms have backed up their headquarters and their databanks so that operations could survive the catastrophic loss of a main site.

We have prepared fairly well to fight the last war--that is, to stop the kinds of attacks that the United States has already experienced. We have done much less, however, to thwart other kinds of plausible strikes. It made sense to move quickly to prevent al Qaeda, with its longstanding interest in airplanes, from easily repeating the 9/11 attacks. But it is time to do a more comprehensive and forward-looking job of protecting the American people.

Al Qaeda may not be as capable as before of "spectacular" attacks in coming years. But it is certainly still capable of using explosives and small arms, with considerable lethality. It may be able to use surface-to-air missiles and other methods of attack as well. There have not been more attacks within the United States. But according to an October, 2005 speech by President Bush, the United States has disrupted three attempted al Qaeda strikes inside the United States, and intercepted at least five more efforts to case targets or infiltrate terrorists into this country. Moreover, the years 2002, 2003, and 2004 have been among the most lethal in the history of global terrorism, with attacks afflicting a wide swath of countries from Spain and Morocco to Tunisia, Saudi Arabia, Pakistan, Indonesia--and of course Iraq. The pattern continued in 2005, and the July 7 London attacks reminded Americans of their continued vulnerability as well.

A U.N. study in early 2005 argued that al Qaeda continues to have easy access to financial resources and bombmaking materials. There were serious worries that al Qaeda would use truck bombs to destroy key financial institutions in New York, Newark, and Washington in 2004. The "shoe bomber," Richard Reid, attempted to destroy an airplane headed to the United States in 2002. U.S. intelligence reports in early 2005 suggested the possibility of attacks using private aircraft or helicopters. Al Qaeda prisoner interviewers and confiscated documents suggest other possible attacks ranging from blowing up gas stations to poisoning water supplies to using crop dusters to spread biological weapons to detonating radioactive dirty bombs. And the country's chemical industry as well as much of its ground transportation infrastructure remain quite vulnerable, as argued by former Deputy Homeland Security Advisor Richard Falkenrath.

Although al Qaeda has been weakened at the top, it remains extremely dangerous. It is now less of a vertical organization than a collection of loosely affiliated local groups that share motivation--and that, like terrorist groups in general, watch and learn from each other. Former CIA Director George Tenet put it succinctly in 2004: "Successive blows to al-Qaeda's central leadership have transformed the organization into a loose collection of regional networks that operate more autonomously." There are benefits from dispersing al Qaeda in this way; the near-term risk of sophisticated catastrophic attacks has probably declined as a result. But the risk of smaller and sometimes quite deadly strikes clearly has not--and the possibility of further catastrophic attacks may well increase again in the future.

The benefits gained by depriving al Qaeda of its previous sanctuary in Afghanistan may not be permanent. That organization may ultimately learn to reconstitute itself with a less formal and more virtual and horizontal network. It may also learn how to avoid terrorist watch lists with some effectiveness, for example by using new recruits--including possibly non-Arabs--to conduct future attacks against western countries. The United States is fortunate not to have, as best we can determine, many al Qaeda cells presently on its soil, as several European countries do. It will be challenging, however, to keep things that way.

As the then-Secretary of Homeland Security, Tom Ridge, said in response to a question about whether he was surprised that there hadn't been another attack on U.S. soil since 9/11, "I'm grateful. That's a better way to put it...many things have been done that have altered their environment...But maybe they just weren't ready. They are strategic thinkers. Even if we've altered their environment and our environment here, they aren't going to go away. They're just going to think of another way to go at the same target or look for another target." CIA Director Porter Goss told Congress in February 2005 that "It may be only a matter of time before al Qaeda or another group attempts to use chemical, biological, radiological, and nuclear weapons." DHS has conducted "red cell" exercises involving a diverse range of creative outside thinkers to contemplate possible new ways al Qaeda might attack, but policy responses to such possibilities have typically been limited in scope and scale.

The Iraq war, whatever its other benefits, also appears not to have alleviated the global terrorism problem. In fact, it is quite possible that it has made it worse by aiding al Qaeda's recruiting efforts and providing an opportunity for a core of hardened terrorists to hone their skills and tighten their organizational networks. To quote Goss again, "Islamic extremists are exploiting the Iraqi conflict to recruit new anti-U.S. jihadists. These jihadists who survive will leave Iraq experienced and focused on acts of urban terrorism." The National Intelligence Council reached a similar conclusion in its 2004 report, Mapping the Global Future.

It is simply not possible to defend a large, open, advanced society from all possible types of terrorism. The United States contains more than half a million bridges, nearly 500 skyscrapers, nearly 200,000 miles of natural gas pipelines, more than 2,800 power plants--the list of critical infrastructure alone is far too long to protect everything, to say nothing of restaurants and movie theaters and schools and malls. Certain special measures, such as providing tight security and even electronic jamming (against the possibility of GPS-guided munitions attack) around the nation's 104 nuclear power plants, clearly cannot be extended to all possible targets.

But to say that we cannot do everything is not to argue for inaction. There is a strong case for taking additional steps to reduce the risks of catastrophic attacks. Al Qaeda seems to prefer such attacks for their symbolic effects and potential political consequences; it is also such tragedies that most jeopardize the country's overall well-being.

Catastrophic attacks include, of course, those that cause large numbers of direct casualties. They also include strikes causing few casualties but serious ripple effects, especially in the economic domain. If a nuclear weapon were discovered in a shipping container, for example, casualties might be prevented--but a shutdown in the nation's trade for a substantial period of time could result as policymakers sought means to prevent a recurrence. Or if a shoulder-launched surface-to-air missile took down an airplane, casualties might be modest--depending on the plane, only a few dozen might be killed--but the effects on the nation's air travel could be devastating and longer-lasting than those of September 11, 2001. As another example, the use of a radiological weapon (in which a conventional explosive disperses radioactive material) would be unlikely to kill many, but could require a very costly and time-consuming cleanup.

Even in areas where homeland security has improved, deficiencies often remain. For example, while antibiotic stocks for addressing any anthrax attack are now fairly robust, means of quickly delivering the antibiotics appear still to be lacking. In the domain of air travel, passengers are not generally screened for explosives, cargo carried on commercial jets is generally not inspected, and private airliners face minimal security scrutiny. Perhaps most of all, whatever security improvements have been made for U.S. carriers, fewer have been made to many foreign carriers that transport large numbers of Americans to and from the United States. Moreover, longer-term worries about biological attacks remain acute, since there could be many types of infectious agents for which antidotes prove unavailable when they are most needed. And the private sector has, for the most part, done very little to protect itself.

It would be a mistake to assume that the creation of the Department of Homeland Security will automatically lead to better protection against such threats. Such reorganizations are extremely difficult, time consuming, and distracting. They can distract attention from efforts to identify remaining key American vulnerabilities and then mitigate them. These problems were of course witnessed during and after Hurricane Katrina in 2005, when FEMA's response to the disaster hardly seemed to have been facilitated by its incorporation within a larger, new organization.

Carrying out a major governmental overhaul when the threat to the nation is so acute is a risky proposition--and not the way the country has typically responded to national crises before. The Department of Defense was not created during World War II, when military leaders had more immediate tasks at hand, but afterwards. Even its much more modest Goldwater Nichols reorganization in 1986 was carried out during a time of relative international peace. By contrast, the DHS has been created in what amounts to a wartime environment--just when its constituent agencies needed to focus on their actual jobs rather than bureaucratic reorganization. Now that that decision has been made, and the third largest department in the government created, it is imperative not to confuse its existence with a successful strategy for protecting the homeland.

And while Congress has improved its ability to address homeland security issues by creating dedicated authorization committees and appropriations subcommittees in both houses, it has not gone far enough. These committees and subcommittees must share jurisdiction with many other committees and subcommittees that insist on a share of the decisionmaking power. This approach is extraordinarily inefficient for executive branch officials who must work with the Congress; in addition, it breeds parochialism among the individual committees and subcommittees about the particular dimensions of homeland security they address. Congress needs to establish the principle that homeland security committees and dedicated appropriations subcommittees should have exclusive jurisdiction over funding that is found within the homeland security realm. Cross-jurisdictional input--that is, the need to gain approval of any initiative from more than one authorizing or appropriating body per house of Congress--may in rare instances be appropriate, but should not be the norm.

TABLES AND QUANTITATIVE ESTIMATES

TABLE 1: POSSIBLE SCALE OF TERRORIST ATTACKS

Possible Estimated
Type of Attack Fatalities Likelihood

Efficient high-potency biological attack 1,000,000 extremely low

Atomic bomb detonated in US city 100,000 very low

Attack (e.g., with conventional explosive or 10,000 very low
airplane) on nuclear or toxic chemical plant

Relatively inefficient biological or chemical 1,000 low
attack in a stadium, train station, skyscraper

Conventional ordnance attack on train, plane 300 modest

Suicide attack with explosives or firearms 100 modest
in a mall or crowded street

Sources: Office of Technology Assessment, Proliferation of Weapons of Mass Destruction: Assessing the Risks (Washington, D.C.: U.S. Congress, 1993); and Michael E. O'Hanlon, Peter R. Orszag, Ivo H. Daalder, I.M. Destler, David L. Gunter, James M. Lindsay, Robert E. Litan, and James B. Steinberg, Protecting the American Homeland: One Year On (Brookings, 2003), p. 6.

TABLE 2: ECONOMIC DISRUPTION AS A RESULT OF TERRORISM

Type of Attack Nature of Economic Disruption Potential Costs

Weapons of mass Extended shutdown in trade, Up to $1 trillion
destruction shipped loss of life, physical destruction,
via container, mail lost production in affected area

Efficient biological attack Disruption to economic activity in $750 billion
affected area, loss of life, loss of
confidence throughout economy

Widespread terror against Significant and sustained decline $250 billion
key elements of public in economic activity in public
economy across nation spaces, loss of confidence
(malls, restaurants, etc.)

Attack on interstate Natural gas shortages in north $150 billion
natural gas pipelines and Midwest, significant decline
in southeast US in economic activity in north

Cyberattacks on Regional electricity shortages $25 billion
computer systems for a week, health risks from
regulating electric heat and cold, interruption
power combined with of production schedules,
physical attacks on destruction of physical capital
transmission/
distribution network

Bombings/bomb scares Effective shutdown of several $10 billion
major cities for a day or two

Source: O'Hanlon et. al., Protecting the American Homeland, p. 7

Fo